Commit a0d5b3c8 for libheif

commit a0d5b3c844304a4c5558383205aba0793d5cc1f9
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Aug 27 00:11:56 2026 +0200

    ci: do not persist GITHUB_TOKEN in the checked-out repositories

    actions/checkout stores the token in .git/config by default so that
    later steps can push or fetch. No step in any workflow does that, but
    the repository-controlled CI scripts and everything they fetch and build
    after checkout (libde265, rav1e, dav1d, cargo-c, the licensecheck script)
    could read the token from there. Set persist-credentials: false on all
    checkout steps.

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e3f7033c..3d222c0b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,6 +28,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/clang.yml b/.github/workflows/clang.yml
index de6fb3b9..2ae2fd56 100644
--- a/.github/workflows/clang.yml
+++ b/.github/workflows/clang.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
@@ -51,6 +53,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index c4f3f571..7eb827cc 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -20,6 +20,8 @@ jobs:
       WITH_X265: 1
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Cache Coverity build tool
       uses: actions/cache@v6
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 38e3adaf..9a17e239 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install emscripten
       run: |
diff --git a/.github/workflows/fuzzer.yml b/.github/workflows/fuzzer.yml
index 450cd940..a47a8d43 100644
--- a/.github/workflows/fuzzer.yml
+++ b/.github/workflows/fuzzer.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/gcc-versions.yml b/.github/workflows/gcc-versions.yml
index b838ac0b..364ae8ac 100644
--- a/.github/workflows/gcc-versions.yml
+++ b/.github/workflows/gcc-versions.yml
@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index ff7846e0..1ffec0da 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -23,6 +23,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - uses: actions/setup-go@v6
       with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3cee00fe..4f0c0e56 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
@@ -33,6 +35,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install compilers
       run: |
@@ -47,6 +51,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install build tools
       run: |
@@ -63,6 +69,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index b2ad1a97..7fb5b5a2 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/osx.yml b/.github/workflows/osx.yml
index 132ed58a..6fe7a67f 100644
--- a/.github/workflows/osx.yml
+++ b/.github/workflows/osx.yml
@@ -22,6 +22,8 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5461a526..2eb528fe 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false

     - name: Install dependencies
       run: |